CVE-2004-1444: Roundup Directory Traversal Vulnerability
Summary
CVE-2004-1444: Roundup Directory traversal vulnerability. Affects roundup versions < 0.7.3. Fixed in 0.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundup is an issue-tracking system that helps manage and track issues, bugs, and tasks in software development. It is designed to be easy to use and customizable, allowing users to create their own issue types and workflows. However, versions 0.6.4 and earlier are vulnerable to a directory traversal attack, which can expose sensitive files on the server.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the Roundup application, specifically through the use of .. (dot dot) sequences in an @@ command within an HTTP GET request. This allows remote attackers to traverse directories and access arbitrary files on the server, potentially leading to unauthorized information disclosure. The impact of this vulnerability can be severe, as it may expose sensitive configuration files, user data, or other critical information stored on the server.
How To Fix
Latest published version: 2.6.0 as of 22 Oct 2026
pip install --upgrade "roundup==2.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.3
This is the first release that contains the fix.
pip install --upgrade "roundup==0.7.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Roundup application by implementing firewall rules or web server configurations that limit access to trusted IP addresses only. Additionally, ensure that sensitive files are not accessible through the web server's document root.
Conclusion
The directory traversal vulnerability in Roundup versions 0.6.4 and earlier poses a significant risk by allowing remote attackers to access arbitrary files on the server. It is crucial to update to version 0.7.3 or later to mitigate this risk. Additionally, implementing temporary workarounds can help protect sensitive data until the update is applied.
See every vulnerability recorded for roundup →
FAQ
A directory traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory structure, potentially exposing sensitive information.
If you are using Roundup version 0.6.4 or earlier, your installation is vulnerable to this issue. You can check your version by running roundup --version in your terminal.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files, which may include configuration files, user data, or other critical information, posing a significant security risk.
Yes, you can use tools like Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
If you cannot update immediately, implement access restrictions and monitor your server logs for any suspicious activity until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for roundup.
